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1.1.  (S/NF)  SUMMARY:  Embassy  Khartoum's  Emergency  Action  Committee 
(EAC)  convened  on  February  28  to  review  a telephone  threat  received 
by  the  Embassy  on  Saturday,  February  27.  The  caller  warned  of  an 
attack  against  the  Embassy  and  urged  personnel  to  evacuate.  RSO 
and  GRPO  updated  EAC  members  on  the  host  government 1 s investigation 
and  the  results  of  local  and  global  telephone  traces.  The  EAC 
members  agreed  that  the  additional  police  and  security  presence  at 
the  Embassy's  six  official  facilities  in  Khartoum  is  commensurate 
with  this  non-specific  threat,  and  that  Post  should  remain  open 
absent  any  further  investigative  developments.  Shortly  after  the 
EAC  meeting  concluded,  the  IMO  was  able  to  retrieve  the  recording 
of  the  threat  calls.  These  files  have  been  passed  to  CIA  HDQs  for 
audio  quality  enhancement  and  analysis.  The  Embassy  remains  on 
high  alert  and  will  provide  any  additional  developments  via  septel. 

END  SUMMARY. 


BACKGROUND  ON  TELEPHONE  THREAT 


T2 . (SBU)  The  DCM  convened  Embassy  Khartoum's  EAC  on  Sunday, 
February  28  (a  work  day  here),  to  review  a telephone  threat 
received  by  the  Embassy  the  previous  day.  The  CDA,  POL,  CONS,  PAO, 
CLO,  MGT , OBO  SSM,  RAO,  DLO,  IMO,  USAID,  MSG,  DRSO,  and  RSO  were  in 
attendance.  The  RSO  briefed  the  EAC  that  at  3:02  p.m.  on  February 
27  the  Embassy's  Tactical  Operations  Center  (TOC)  received  a call 
on  the  main  embassy  telephone  line  from  an  individual  warning  that 
the  Embassy  should  evacuate  the  building  because  of  a pending 
attack.  When  asked  to  speak  slowly  and  to  confirm  the  location  of 
the  attack,  the  caller  hung  up. 


13.  (SBU)  Approximately  four  minutes  later  the  same  individual 
called  again  and  urged  that  personnel  evacuate  the  Embassy  due  to 
what  he  said  would  be  an  attack  with  explosives.  The  caller 
identified  himself  as  "Khalid  Ibrahim,"  but  did  not  specify  a time, 
location,  or  nature  of  the  attack.  The  TOC  supervisor  said  the 
caller  sounded  like  a young  male,  but  he  could  not  detect  a 
Sudanese  or  other  discernable  accent  because  the  caller  only  spoke 
in  English.  The  TOC  supervisor  believed  the  caller  to  be 
sympathetic,  and  said  he  sounded  genuinely  concerned  about  warning 
Embassy  personnel.  The  guard  recorded  the  caller's  number,  which 
was  displayed  on  the  switchboard,  but  was  unable  to  detect  any 
background  noise  or  other  distinguishing  identifiers  during  the 
call.  The  number,  904  397  870,  appears  to  be  a Sudanese  cell  phone 
operated  by  the  Zain/Mobitel  carrier. 


IMMEDIATE  ACTIONS  TAKEN 


1_4 . (S/NF)  All  of  the  RSOs  were  present  at  the  Embassy  packing  for 
the  upcoming  NEC  move  when  the  threat  call  was  received.  RSO 
immediately  notified  GRPO  who  passed  the  threat  information,  along 
with  the  caller's  telephone  number,  to  the  Sudanese  National 
Intelligence  and  Security  Service  (NISS)  for  immediate 
investigation.  The  RSO  contacted  the  Sudanese  National  Police's 
Criminal  Investigative  Division  (CID)  and  the  Diplomatic  Police 
Unit  to  increase  security  at  all  office  facilities.  Senior  RSO 
locally-engaged  staff  (LES),  including  the  Defensive  Systems 
Commander  (DSC)  and  the  Senior  Foreign  Service  National 
Investigator  (S/FSNI),  responded  to  the  Embassy  to  follow-up  with 
their  police  and  security  service  contacts.  The  Sudanese  National 
Police  immediately  placed  their  officers  on  heightened  alert  and 
deployed  armed  riot  police  to  the  Chancery.  The  CID  Director 
General  assigned  Colonel  Ahmed  Ali  of  the  Khartoum  State  Police's 
Criminal  Investigative  Division  as  the  officer-in-charge  of  the 
investigation  and  provided  his  cell  phone  contact  to  the  S/FSNI. 


15.  (SBU)  RSO  notified  the  DCM,  0B0  SSM,  MSG  DetCmdr,  and  ConGen 

Juba  RSO.  The  DCM  informed  the  CDA  via  an  email,  as  the  latter 
was  out  of  the  country  and  scheduled  to  return  later  that  night 
from  the  AF/E  COM  Conference  in  Nairobi.  The  DCM  also  called  CG 
Juba  and  the  USAID  Acting  Mission  Director  in  Khartoum.  The 
after-hours  emergency  cascade  system  was  activated  to  inform 
Mission  personnel  of  the  threat,  and  to  remind  all  staff  to 
increase  their  vigilance,  to  be  on  the  lookout  for  suspicious 
activity  or  possible  surveillance,  and  to  keep  their  radio  and  cell 
phone  with  them  at  all  times.  The  RSO  Section  conducted  internal 
defense  drills  on  the  evening  of  February  27  to  review  operational 
plans  for  several  different  possible  attack  scenarios  at  the 
existing  Chancery.  The  MSG  Detachment  had  already  pre-positioned 
their  personal  protective  equipment  at  the  NEC  in  anticipation  of 
the  March  24  NEC  move,  but  returned  one  set  of  this  gear  to  the 
Chancery  and  observed  the  RSO ' s internal  defense  drill  to  be 
familiar  with  the  current  operation  plans. 


INVESTIGATIVE  UPDATE 


1[6 . (S/NF)  GRPO  informed  the  EAC  that  traces  were  still  ongoing, 
but  preliminary  results  revealed  two  January  2,  2010  calling  events 
made  in  Cairo  that  were  possibly  linked  to  the  caller's  number. 

GRPO  stated  he  would  be  coordinating  with  Cairo  for  possible 
assistance  from  the  Egyptian  service.  He  also  confirmed  that  NISS 
took  this  threat  very  seriously  and  had  spent  the  night 
investigating  it. 


17.  (SBU)  After  the  EAC  concluded,  the  CID  requested  the  Embassy  to 
allow  the  TOC  guard  supervisor  to  be  interviewed.  He  went  to  the 
police  station  for  a one  hour  interview  and  subsequently  reported 
to  RSO  that  he  recounted  the  call  to  investigators,  made  a 
statement,  and  was  treated  very  cordially. 


1[8 . (S/NF)  IMO  was  also  able  to  obtain  the  recording  of  the  calls 
from  the  telephone  switch  threat  recorder.  Copies  of  the  .wav 
files  were  passed  to  GRPO  to  send  to  CIA  HDQs  for  audio  enhancement 
and  analysis.  RSO  requested  assistance  from  an  Embassy  linguist 
who  provided  the  following  unofficial  transcript  of  the  calls: 


BEGIN  TEXT 


First  Call  - 27FEB2010  1502h 


— American  Embassy,  may  I help  you? 


--  Listen,  there's  a terrorist  attack  that's  ...  there  s/1  car  full 
of  (3-  garbled  words)  of  sl/nitro  or  nitrates,  there's  a car  full 
of  explosive  materials  sl/directed  on  U.S.  Embassy.  (It's  an) 
emergency  situation. 


— Where  (is)  the  emergency? 


— I repeat,  they're  plan  (a)  terrorist  attack. 


--  Yes,  please,  please.  Could  you  speak  slowly? 

— There's  s/1  car  full  of  s/1  100  million  of  s/1  nitro  and  ... 
(call  disconnected). 


Second  Call  - 27FEB2010  1506h 


— Yes,  American  Embassy. 


--  I call  about  the  terrorist  attack.  (It's)  a terrible  situation. 


--  Where,  where?  Where,  which  location? 


— They're  trying  attack  United  States  Embassy. 


— The  United  States  Embassy  where? 


— In  Khartoum  Embassy. 


--  In  where? 


--  In  Khartoum  Embassy. 


Khartoum  DC? 


--  Yes. 

--  s/1  Planned  job,  you  have  to  listen. 

--  Who... What's  your  name? 

--  Yes,  I'm  Khalid  (says  his  name  with  a "k"  sound) 

— Khalid 

--  Yes,  Khalid  Ibrahim 
--  Ibrahim  . . . from  where? 

--  Yes,  I'm  not  from  here. 

--  Where? 

--  Okay. 

--  Where  are  you,  where  are  you... yes? 

--  Evacuate  the  Embassy  right  now  ...  I'm  telling  you,  this  (is)  a 
terrible  situation. 

--  Could  I,  could  you.... I will  link  you  to  one  of  my  supervisors? 

— I don't  have  this  time,  listen. 

— Yes? 

--  s/1  time  is  gone,  okay? 

--  What?  What  can  happen,  what  can  happen?  (Call  ends.) 


END  TEXT 


1[9 . (SBU)  Post  requests  that  DS/ICI/PII  assign  a case  number  to 
this  threat  for  future  reference.  Any  investigative  update  will  be 
sent  via  septel.  POC  is  RSO  Chuck  Lisenbee  who  can  be  reached  at 
lisenbeenx@state.gov  or  mobile  +249  912  308  731. 

WHITEHEAD 


